Skip to content
Veraproof Veraproof Docs

Dropbox Sign Integration

Dropbox Sign Integration

Scimify enables SCIM provisioning for Dropbox Sign team members, allowing you to invite users and manage team roles through your identity provider.

Overview

This integration (de)provisions users on your Dropbox Sign team. Scimify accepts standard SCIM requests from your IdP and translates them into Dropbox Sign team API calls.

Key behaviors:

  • User-only — no group provisioning
  • Invite-based provisioning — new users are invited to the team (they must accept before they are active members)
  • Role management — optional dropboxSign_role SCIM attribute maps to Dropbox Sign team roles on invite
  • Deprovisioning — removing access removes the team member or cancels a pending invite
  • Document transfer (optional) — Enterprise plans can configure a default recipient for removed users’ documents

Prerequisites

  • A Dropbox Sign account with team features and an API key from API settings
  • Permission to invite and remove team members
  • Your IdP configured for SCIM provisioning (see Okta SCIM Configuration)

For API details, see Dropbox Sign authentication and Team API.

Configuration Steps

1. Create a Dropbox Sign API Key

  1. Sign in to Dropbox Sign
  2. Open API settings on your account
  3. Create or copy/reveal an API key

Note: A dedicated service account user is recommended for the API key so the integration doesn’t break on employee lifecycle changes

2. Configure the Integration in Scimify

  1. Navigate to the Integrations page in your Scimify admin console
  2. Create a new Dropbox Sign integration instance
  3. Set an instance display name (for example, Production Dropbox Sign Team)
  4. Enter your API Key
  5. Optionally set Document transfer email (see Enterprise document transfer)
  6. Save the configuration and use Test connection to verify API access
  7. Enable the integration and copy the Scimify SCIM endpoint and API key for your IdP

Your Dropbox Sign team is determined by the API key; no separate team ID is required in Scimify.

3. Configure Team Role Management (Optional)

To assign Dropbox Sign team roles via SCIM, add the dropboxSign_role custom attribute to your IdP user profile and map it into the SCIM user payload.

If dropboxSign_role is omitted, Scimify assigns the default role Member.

4. Configure IdP SCIM

Follow the Okta SCIM Configuration guide to connect your IdP to your Scimify Dropbox Sign instance, then assign users to the SCIM app.

Enterprise document transfer on deprovision

Dropbox Sign Enterprise plans support transferring a removed member’s documents, templates, and API apps to another team account when a user is removed from the team.

In Scimify, set Document transfer email to the email address of a team member (typically a dedicated service account) who should receive those assets when users are deprovisioned via SCIM. Scimify passes this value as new_owner_email_address on the Remove User from Team API call.

Note: This setting is only available on Dropbox Sign Enterprise plans. On other plans, the field may be ignored or the API may return an error on deprovision — leave the field empty if you are not on Enterprise.

How It Works

User Provisioning

When a user is assigned in your IdP:

  1. Scimify checks whether the email already exists as an active team member
  2. If not, Scimify checks for an existing pending invite for that email
  3. If neither exists, Scimify invites the user to your Dropbox Sign team with the requested role

The invited user must accept the invite before they appear as an active team member in Dropbox Sign.

User Updates

  • Pending invites — Dropbox Sign does not support updating an invite in place; Scimify removes the pending invite and sends a new invite when dropboxSign_role changes
  • Active members — the Dropbox Sign API does not expose a role-update endpoint for accepted members; Scimify does not change active members’ roles when dropboxSign_role is updated (no-op). Change roles manually in Dropbox Sign if needed
  • Profile fields — name and email are not updated through this integration; role is the supported attribute on create and for pending invites

User Deprovisioning

When a user is unassigned or deactivated in your IdP:

  • Active members are removed from the team
  • Pending invites are cancelled

This is a hard remove from the team (not a soft disable in Dropbox Sign).

If Document transfer email is configured and your plan supports it, removed users’ documents are transferred to that account.

Custom SCIM Attribute Configuration

To manage Dropbox Sign team roles from your IdP, configure the following custom attribute.

Attribute: dropboxSign_role

SettingValue
TypeString
External namespaceurn:ietf:params:scim:schemas:extension:custom:2.0:User
Attribute namedropboxSign_role
DescriptionDropbox Sign team role for the invited or provisioned user
DefaultMember (if not sent in SCIM)

Valid values:

ValueDescription
MemberStandard team member (default)
DeveloperDeveloper role (API plan teams)
Team ManagerTeam manager role
AdminTeam administrator

Scimify accepts dropboxSign_role in any of these common SCIM shapes:

  • Top-level field: dropboxSign_role
  • Extension key: urn:ietf:params:scim:schemas:extension:custom:2.0:User:dropboxSign_role
  • Nested extension object: urn:ietf:params:scim:schemas:extension:custom:2.0:User → { "dropboxSign_role": "Developer" }

Suggested Okta profile attribute

  1. In Okta, add a user profile attribute for your Dropbox Sign SCIM app:
    • Display name: Dropbox Sign team role
    • Variable name: e.g. dropboxSignRole
    • Type: string
    • External namespace: urn:ietf:params:scim:schemas:extension:custom:2.0:User
    • External name: dropboxSign_role
  2. Restrict values to the supported list above (enumerated profile field or lifecycle rule)
  3. Map the attribute in the Okta → Scimify provisioning profile so it is included on create and update

Mapping guidance

  • Set a sensible default (typically Member) for standard employees
  • Use entitlements or group rules to assign Developer, Team Manager, or Admin where appropriate
  • Role changes on accepted members are not applied by Scimify — update roles in Dropbox Sign directly if needed

Limitations and Behavior Notes

  • Invite-based create — SCIM “create user” invites a team member; users are not fully active until they accept
  • Pending invite tracking — Scimify stores invite identifiers until acceptance; lookups reconcile invite vs member IDs on refresh
  • No group support — this connector does not create or sync groups
  • Role updates for active members — only pending invites receive role changes via SCIM; active members require manual role updates in Dropbox Sign
  • Enterprise document transfer — optional new_owner_email_address only applies on Enterprise plans
  • API key scope — Dropbox Sign API keys are not scope-restricted; use a dedicated admin key where possible

Troubleshooting

  • Authentication failed (401)
    • Confirm the API key is correct and active in Dropbox Sign API settings
    • Regenerate the key and update the Scimify integration config
  • team_invite_failed
    • The user may already belong to another Dropbox Sign team
    • Resolve team membership in Dropbox Sign before reprovisioning
  • Invalid dropboxSign_role
    • Ensure the value is one of: Member, Developer, Team Manager, Admin
  • Deprovision failed with document transfer configured
    • Confirm your Dropbox Sign plan is Enterprise and the transfer email is an active team member
    • Clear Document transfer email if you are not on Enterprise
  • User not removed after deprovision
    • Verify the user was unassigned from the IdP SCIM app and provisioning ran successfully
    • Check Scimify audit logs for remove-member operations

Additional Resources

Need Help?

If you encounter issues configuring dropboxSign_role mappings, API access, or Enterprise document transfer, contact [email protected] for assistance.